Fifth Rule 3 population (function declarations) widened, censused ids stripped, and the gate states its own scan boundary; hot-reload refusal ids stripped (#13298)

* feat(tooling): fifth population — plain function declarations join Rule 3's sink pass, and the gate states its own scan boundary

The fifth widening (#13156's A half, adjudicated 2026-08-29): a plain
`function` DECLARATION is transparent to the climb exactly when its NAME
is consumed from a recognised customer-facing position — the same narrow
clause as the fourth population, one declaration form over, never an
unconditional crawl of function bodies. Its literals get their own
`functionDeclared` bucket with its own blindness floor, so the
declaration clause rotting cannot hide behind the arrow members.

The C half (shared with the family member card): the gate's output now
prints Rule 3's scan boundary — the root, the not-scanned siblings with
the deferral pointer, and the recognised sink-shape list — derived from
the constants the scan reads, pinned derived-vs-derived in --self-test.

At this commit the widened gate is deliberately RED on the real tree
(reproduce-first): 4 violations — 2 functionDeclared, 2 message via the
new closure into declarations. The strip is the next commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KX8wnyjStaZcuMyAMNsy3N

* fix(spec): strip internal tracker ids from function-declaration-built refusal prose, re-pin the twins

The strip half of the fifth-population adjudication (2026-08-29, Class-1),
under the keep-the-ADR-id charter: 17 ids across 8 spec sources — the 15
the broad declaration census finds on current origin/main (materially
fewer than the relayed 47/51/14, measured before today's main moved) plus
the 2 hoisted ruling consts the widened sink closure newly reaches
(SUBMIT_REDIRECT_RULING, FORM_VIEW_FEATURES_RULING). ADR ids, protocol
versions, error codes and ruling dates stay; ids that were the whole
parenthetical take the parenthetical with them; load-bearing internal
references move to adjacent comments.

Twins re-pinned red-then-green, never weakened: 42 assertions across 7
spec test files red before this commit, 607/607 green after, each re-pin
a customer-resolvable anchor from the NEW text plus negative id pins at
the two ruling-const doors. The objectql and service-analytics twins
flagged by the id sweep pin sources OUTSIDE the scanned root and are
deliberately untouched (evidence for the cross-package revival census).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KX8wnyjStaZcuMyAMNsy3N

* fix(core): strip tracker ids from HotReloadManager's author-facing refusal messages, re-pin the twins

The member half of the 2026-08-29 family adjudication: the ruled strip is
the plugin-registration refusal's tracker id (the id the #13151-verified
twins at hot-reload.test.ts:259,302,310 pin); the sibling id in the same
refusal table's watchPatterns entry and in the startWatching() removal
notice is stripped in the same stroke under the bounded same-class
extension — same defect family, same keep-the-ADR-id remedy, same file,
same twin suite, declared in the PR body. ADR-0049, the spec/core
versions and the scheduleReload migration call stay as the
customer-resolvable anchors.

Twins red-then-green, never weakened: 8 assertions red before this
commit (10/18 passing), 18/18 after; each id pin re-pinned to a content
anchor from the NEW text plus negative id pins at all three doors —
mirroring the negative pin the spec-side parse door has carried since its
own strip. Repo-wide section-7 sweep for the stripped id set: the only
other test literal is an expect failure-label, not a content pin.

Root extension of the doc-authoring gate's Rule 3 is deliberately NOT
part of this change (deferred by the adjudication; the gate's new
boundary output is what keeps that deferral visible).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KX8wnyjStaZcuMyAMNsy3N

* test(spec): re-pin the two compose-stacks predicate twins the id sweep's callee filter missed

Found by RUNNING the full mention set rather than trusting the sweep's
expect-callee filter: both pins spell the id check inside a .some()
predicate, so the nearest enclosing call is w.includes, not expect. Same
re-pin discipline — anchored on the warning's own prescription words
(COMPOSE_KEY_DISPOSITIONS / 'cannot be composed'), red-then-green
(2 red in the consumer batch, 35/35 green after), never weakened.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KX8wnyjStaZcuMyAMNsy3N

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-project-manager

.changeset/fifth-population-spec-strip.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/spec": patch
+---
+
+Customer-facing refusal and warning messages built inside plain `function` declarations (and two hoisted ruling consts) no longer cite internal tracker ids. The teaching stays; customer-resolvable anchors stay — ADR ids, protocol versions, error codes such as `INVALID_FILTER / 400`, and ruling dates — while the `#NNNN` tokens, which resolve to nothing for a refused author, are gone. The doc-authoring gate now recognises function declarations as text sinks (its fifth population, with its own blindness floor) and prints its own scan boundary, so the next boundary move is visible from the gate's output.

.changeset/hot-reload-refusal-id-strip.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/core": patch
+---
+
+`HotReloadManager`'s refusal messages — the plugin-registration doors for retired `stateStrategy` values and removed config keys, and the `startWatching()` removal notice — no longer cite internal tracker ids. The prescriptions keep their customer-resolvable anchors (ADR-0049 enforce-or-remove, the `@objectstack/spec` / `@objectstack/core` versions, and the `scheduleReload` migration call); the `#NNNN` tokens, which resolve to nothing for the host author reading the refusal, are gone.

packages/core/src/hot-reload.test.ts

@@ -256,11 +256,14 @@ describe('[#12340] stateStrategy refusal', () => {
       // doors (parse vs registration) and are deliberately not shared.
       const m = caught?.message ?? '';
       expect(m).toContain(retired);
-      expect(m).toContain('#12340');
-      expect(m).toContain('ADR-0049');
+      expect(m).toContain('ADR-0049 enforce-or-remove');
       expect(m).toContain('were removed');
       expect(m).toContain("Use 'memory'");
       expect(m).toContain('p'); // locates the offending plugin
+      // The negative twin (#13179's strip): the prescription anchors on the
+      // ADR and the version — never on a tracker id the refused author
+      // cannot resolve. Mirrors the spec-side door's own pin.
+      expect(m).not.toMatch(/(?<![#&])#\d{3,5}(?![0-9A-Za-z])/);
     });
   }
 
@@ -299,15 +302,16 @@ describe('[#12340] stateStrategy refusal', () => {
     expect(caught?.code).toBe('VALIDATION_ERROR');
     expect(caught?.status).toBe(400);
     expect(caught?.message).toContain('distributedConfig');
-    expect(caught?.message).toContain('#12340');
+    expect(caught?.message).toContain('ADR-0049 enforce-or-remove');
     expect(caught?.message).toContain('nothing ever read it');
+    expect(caught?.message).not.toMatch(/(?<![#&])#\d{3,5}(?![0-9A-Za-z])/);
   });
 
   it('refuses even when hot reload is disabled', () => {
     // The door must not depend on `enabled`: a false declaration is false
     // whether or not the feature is switched on.
     const cfg = { ...configWith('disk'), enabled: false } as HotReloadConfigParsed;
-    expect(() => mgr.registerPlugin('p', cfg)).toThrow(/#12340/);
+    expect(() => mgr.registerPlugin('p', cfg)).toThrow(/were removed/);
   });
 
   for (const live of ['memory', 'none'] as const) {
@@ -377,18 +381,20 @@ describe('[#12428] startWatching refusal and the watch-handle removal', () => {
     // The prescription's load-bearing facts, by CONTENT — this message is the
     // whole migration document for whoever hits it.
     const m = caught?.message ?? '';
-    expect(m).toContain('#12428');
-    expect(m).toContain('ADR-0049');
+    expect(m).toContain('ADR-0049 enforce-or-remove');
     expect(m).toContain('never watched');
     expect(m).toContain('scheduleReload');
     expect(m).toContain('p'); // locates the offending plugin
+    // The negative twin (#13179's strip, extended to this door's sibling id):
+    // anchored on the ADR and the migration call, never on a tracker id.
+    expect(m).not.toMatch(/(?<![#&])#\d{3,5}(?![0-9A-Za-z])/);
   });
 
   it('refuses startWatching for an UNREGISTERED plugin too', () => {
     // The old body early-returned when the plugin was unknown or disabled, so
     // the lie was conditional. The refusal must not be: the method never
     // worked for anyone, in any state.
-    expect(() => mgr.startWatching('never-registered')).toThrow(/#12428/);
+    expect(() => mgr.startWatching('never-registered')).toThrow(/never watched/);
   });
 
   it('refuses a leftover watchPatterns at registration', () => {
@@ -406,16 +412,17 @@ describe('[#12428] startWatching refusal and the watch-handle removal', () => {
     expect(caught?.code).toBe('VALIDATION_ERROR');
     expect(caught?.status).toBe(400);
     expect(caught?.message).toContain('watchPatterns');
-    expect(caught?.message).toContain('#12428');
+    expect(caught?.message).toContain('ADR-0049 enforce-or-remove');
     expect(caught?.message).toContain('nothing ever read it');
+    expect(caught?.message).not.toMatch(/(?<![#&])#\d{3,5}(?![0-9A-Za-z])/);
   });
 
   it('refuses watchPatterns even when hot reload is disabled', () => {
     // The door must not depend on `enabled` — a false declaration is false
     // whether or not the feature is switched on.
     expect(() =>
       mgr.registerPlugin('p', liveConfig({ enabled: false, watchPatterns: ['a/**'] }))
-    ).toThrow(/#12428/);
+    ).toThrow(/nothing ever read it/);
   });
 
   it('still registers a config that does not carry the retired key', () => {

packages/core/src/hot-reload.ts

@@ -45,7 +45,7 @@ const HONOURED_STATE_STRATEGIES = ['memory', 'none'] as const;
  */
 const RETIRED_STATE_STRATEGY_GUIDANCE =
   "'disk' and 'distributed' were removed from HotReloadConfig.stateStrategy in "
-  + '@objectstack/spec 18 (#12340, ADR-0049 enforce-or-remove) — neither was ever '
+  + '@objectstack/spec 18 (ADR-0049 enforce-or-remove) — neither was ever '
   + "implemented. Both wrote to the same in-memory Map as 'memory' and reported it "
   + 'only at debug level, so a host that asked for durable or cluster-replicated '
   + 'state got process-local memory and no error. '
@@ -111,7 +111,7 @@ const RETIRED_HOT_RELOAD_KEYS: ReadonlyArray<readonly [string, string]> = [
   [
     'distributedConfig',
     "'distributedConfig' was removed from "
-    + 'HotReloadConfig in @objectstack/spec 18 (#12340, ADR-0049 '
+    + 'HotReloadConfig in @objectstack/spec 18 (ADR-0049 '
     + 'enforce-or-remove) — nothing ever read it. A provider, endpoints, a key '
     + 'prefix, a TTL and a replication factor could all be declared and no '
     + "connection was ever opened. It left with the stateStrategy: 'distributed' "
@@ -121,7 +121,7 @@ const RETIRED_HOT_RELOAD_KEYS: ReadonlyArray<readonly [string, string]> = [
   [
     'watchPatterns',
     "'watchPatterns' was removed from HotReloadConfig in @objectstack/spec 18 "
-    + '(#12428, ADR-0049 enforce-or-remove) — nothing ever read it. Its only two '
+    + '(ADR-0049 enforce-or-remove) — nothing ever read it. Its only two '
     + 'uses were log lines: no watcher was ever constructed from it, so an author '
     + 'could declare a glob and no file change ever triggered a reload. File '
     + 'watching is the HOST\'s job in this host-driven library. Delete the key, '
@@ -322,7 +322,7 @@ export class HotReloadManager {
   startWatching(pluginName: string): never {
     throw hotReloadRefusal(
       `[HotReload] Plugin '${pluginName}': startWatching() never watched `
-      + 'anything and was removed in @objectstack/core 18 (#12428, ADR-0049 '
+      + 'anything and was removed in @objectstack/core 18 (ADR-0049 '
       + "enforce-or-remove). It logged 'File watching started' at info level "
       + 'while no watcher was ever constructed, so no file change could ever '
       + 'trigger a reload. File watching is the HOST\'s job in this '

packages/spec/src/compose-stacks-key-loss.test.ts

@@ -158,7 +158,7 @@ describe('#5005 rule 2 — conflicting values throw a prescriptive error', () =>
 // ─── Rule 3 — unhandled keys warn ───────────────────────────────────
 
 describe('#5005 rule 3 — a key with no declared rule warns', () => {
-  it('warns once, names the key and points at #5005', () => {
+  it('warns once, names the key and carries the declare-a-rule prescription', () => {
     // A key the schema does not declare: reaches composeStacks only via
     // `strict: false`, which is exactly how a NEW key looks before someone
     // remembers to teach the composer about it.
@@ -167,11 +167,13 @@ describe('#5005 rule 3 — a key with no declared rule warns', () => {
 
     const composed = composeStacks([a, b]) as Record<string, unknown>;
 
-    // One warning that both names the key AND points at #5005 — not two
-    // unrelated ones (`defineStack` also warns about undeclared keys).
+    // One warning that both names the key AND carries the prescription — not
+    // two unrelated ones (`defineStack` also warns about undeclared keys).
+    // Anchored on the prescription's own words, never on a tracker id the
+    // author cannot resolve (#13156's strip).
     const warnings = warnSpy.mock.calls.map((c) => String(c[0]));
     expect(
-      warnings.some((w) => w.includes('composeStacks') && w.includes("'futureThing'") && w.includes('#5005')),
+      warnings.some((w) => w.includes('composeStacks') && w.includes("'futureThing'") && w.includes('COMPOSE_KEY_DISPOSITIONS')),
     ).toBe(true);
     // …and it is composed by the default rule rather than dropped.
     expect(composed.futureThing).toEqual({ enabled: true });
@@ -195,7 +197,7 @@ describe('#5005 rule 3 — a key with no declared rule warns', () => {
     expect(
       warnSpy.mock.calls
         .map((c) => String(c[0]))
-        .some((w) => w.includes('composeStacks') && w.includes("'views'") && w.includes('#5005')),
+        .some((w) => w.includes('composeStacks') && w.includes("'views'") && w.includes('cannot be composed')),
     ).toBe(true);
   });
 

packages/spec/src/data/date-range-presets.test.ts

@@ -67,7 +67,10 @@ describe('date-range preset vocabulary (#4614, re-homed by #8793)', () => {
     expect(message).toContain('$gte');            // the position it sat in
     expect(message).toContain('{30_days_ago}');   // the spelling that works
     expect(message).toContain('2026-01-15');      // the ISO alternative
-    expect(message).toContain('#8793');           // attributable from the error alone
+    // Attributable from the error alone by the customer-resolvable sentence —
+    // never by a tracker id (#13156's strip).
+    expect(message).toContain('Refused at authoring time so the error surfaces where the filter is written.');
+    expect(message).not.toMatch(/(?<![#&])#\d{3,5}(?![0-9A-Za-z])/);
     // A calendar preset prescribes its window pair.
     const window = bareDateRangePresetComparandMessage('this_week', '$lt');
     expect(window).toContain('{week_start}');

packages/spec/src/data/date-range-presets.ts

@@ -128,9 +128,9 @@ export function bareDateRangePresetComparandMessage(
     + `understood by the dashboard date-filter positions (dateRange.defaultRange, a date `
     + `global filter's defaultValue), where the console lowers it to {date-macro} bounds `
     + `before querying. As a bare "${operator}" comparand nothing resolves it: a declared `
-    + `datetime/date field refuses the query at the engine (INVALID_FILTER / 400, #8690), `
+    + `datetime/date field refuses the query at the engine (INVALID_FILTER / 400), `
     + `and any other column compares the literal string. Write the date-macro window `
     + `instead — e.g. ${window} — or an ISO date such as "2026-01-15". `
-    + `Refused at authoring time so the error surfaces where the filter is written (#8793).`
+    + `Refused at authoring time so the error surfaces where the filter is written.`
   );
 }

packages/spec/src/data/default-value-shape.ts

@@ -198,7 +198,7 @@ export function defaultValueTokenIssue(
     `Field "${name}" (${def.type}): the default ${JSON.stringify(dv)} is the runtime token \`current_user\` — `
     + `resolved by the engine to the acting user's \`sys_user.id\` at insert time — and a \`${def.type}\` field `
     + `cannot hold one${lookupAside}. It is legal only on a \`user\` field or a \`lookup\` with `
-    + "`reference: 'sys_user'` (#4560 records what happens when that id lands anywhere else). Use one of "
+    + "`reference: 'sys_user'` — anywhere else the resolved id is dead data at best. Use one of "
     + 'those, or write a literal record id.'
   );
 }

packages/spec/src/data/field.test.ts

@@ -919,7 +919,7 @@ describe('FieldSchema', () => {
         const issue = r.error.issues.find((i) => i.message.includes('last_30_days'));
         expect(issue, 'the preset refusal must surface through relatedListFilter').toBeTruthy();
         expect(issue!.path).toEqual(['relatedListFilter', 'created_at', '$gte']);
-        expect(issue!.message).toContain('#8793');
+        expect(issue!.message).toContain('Refused at authoring time so the error surfaces where the filter is written.');
       }
     });
 

packages/spec/src/data/filter-comparand-shape.ts

@@ -222,7 +222,7 @@ function nonListComparandError(
     `"${op}" tests membership of a list — write ${shapePreview([value])} for a single value` +
     (alternative ? `, or use ${alternative} to compare against it` : '') +
     `. Authoring spellings: ${spellings.join(', ')}. The filter was NOT applied, and an ` +
-    `unapplied filter would have returned the UNFILTERED result set (#5869).`,
+    `unapplied filter would have returned the UNFILTERED result set.`,
   );
 }
 
@@ -247,7 +247,7 @@ function malformedRangeComparandError(
     `value array. Received ${describeOperand(value)} (${shapePreview(value)}) at ${path}. ` +
     `A range needs exactly two bounds, in order; the authoring spelling that lowers to ` +
     `"$between" is "between". The filter was NOT applied, and an unapplied filter would have ` +
-    `returned the UNFILTERED result set (#5869).`,
+    `returned the UNFILTERED result set.`,
   );
 }